aporthq-sdk-python 0.1.0__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- aporthq_sdk_python-0.1.0/LICENSE +21 -0
- aporthq_sdk_python-0.1.0/PKG-INFO +288 -0
- aporthq_sdk_python-0.1.0/README.md +253 -0
- aporthq_sdk_python-0.1.0/pyproject.toml +65 -0
- aporthq_sdk_python-0.1.0/setup.cfg +4 -0
- aporthq_sdk_python-0.1.0/src/aporthq_sdk_python/__init__.py +42 -0
- aporthq_sdk_python-0.1.0/src/aporthq_sdk_python/decision_types.py +83 -0
- aporthq_sdk_python-0.1.0/src/aporthq_sdk_python/errors.py +31 -0
- aporthq_sdk_python-0.1.0/src/aporthq_sdk_python/exceptions.py +32 -0
- aporthq_sdk_python-0.1.0/src/aporthq_sdk_python/shared_types.py +59 -0
- aporthq_sdk_python-0.1.0/src/aporthq_sdk_python/thin_client.py +306 -0
- aporthq_sdk_python-0.1.0/src/aporthq_sdk_python.egg-info/PKG-INFO +288 -0
- aporthq_sdk_python-0.1.0/src/aporthq_sdk_python.egg-info/SOURCES.txt +15 -0
- aporthq_sdk_python-0.1.0/src/aporthq_sdk_python.egg-info/dependency_links.txt +1 -0
- aporthq_sdk_python-0.1.0/src/aporthq_sdk_python.egg-info/requires.txt +9 -0
- aporthq_sdk_python-0.1.0/src/aporthq_sdk_python.egg-info/top_level.txt +1 -0
- aporthq_sdk_python-0.1.0/tests/test_thin_client.py +377 -0
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
MIT License
|
|
2
|
+
|
|
3
|
+
Copyright (c) 2025 LiftRails Inc.
|
|
4
|
+
|
|
5
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
6
|
+
of this software and associated documentation files (the "Software"), to deal
|
|
7
|
+
in the Software without restriction, including without limitation the rights
|
|
8
|
+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
9
|
+
copies of the Software, and to permit persons to whom the Software is
|
|
10
|
+
furnished to do so, subject to the following conditions:
|
|
11
|
+
|
|
12
|
+
The above copyright notice and this permission notice shall be included in all
|
|
13
|
+
copies or substantial portions of the Software.
|
|
14
|
+
|
|
15
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
16
|
+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
17
|
+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
18
|
+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
19
|
+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
20
|
+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
21
|
+
SOFTWARE.
|
|
@@ -0,0 +1,288 @@
|
|
|
1
|
+
Metadata-Version: 2.4
|
|
2
|
+
Name: aporthq-sdk-python
|
|
3
|
+
Version: 0.1.0
|
|
4
|
+
Summary: Python SDK for The Passport for AI Agents
|
|
5
|
+
Author-email: APort Team <team@aport.io>
|
|
6
|
+
License: MIT
|
|
7
|
+
Project-URL: Homepage, https://aport.io
|
|
8
|
+
Project-URL: Documentation, https://aport.io/docs
|
|
9
|
+
Project-URL: Repository, https://github.com/aporthq/agent-passport
|
|
10
|
+
Project-URL: Issues, https://github.com/aporthq/agent-passport/issues
|
|
11
|
+
Keywords: agent-passport,ai,authentication,verification,aport,mcp,middleware
|
|
12
|
+
Classifier: Development Status :: 4 - Beta
|
|
13
|
+
Classifier: Intended Audience :: Developers
|
|
14
|
+
Classifier: Programming Language :: Python :: 3
|
|
15
|
+
Classifier: Programming Language :: Python :: 3.8
|
|
16
|
+
Classifier: Programming Language :: Python :: 3.9
|
|
17
|
+
Classifier: Programming Language :: Python :: 3.10
|
|
18
|
+
Classifier: Programming Language :: Python :: 3.11
|
|
19
|
+
Classifier: Programming Language :: Python :: 3.12
|
|
20
|
+
Classifier: Topic :: Software Development :: Libraries :: Python Modules
|
|
21
|
+
Classifier: Topic :: Security
|
|
22
|
+
Classifier: Topic :: Internet :: WWW/HTTP :: Dynamic Content
|
|
23
|
+
Requires-Python: >=3.8
|
|
24
|
+
Description-Content-Type: text/markdown
|
|
25
|
+
License-File: LICENSE
|
|
26
|
+
Requires-Dist: aiohttp>=3.8.0
|
|
27
|
+
Requires-Dist: typing-extensions>=4.0.0
|
|
28
|
+
Provides-Extra: dev
|
|
29
|
+
Requires-Dist: pytest>=7.0.0; extra == "dev"
|
|
30
|
+
Requires-Dist: pytest-cov>=4.0.0; extra == "dev"
|
|
31
|
+
Requires-Dist: black>=22.0.0; extra == "dev"
|
|
32
|
+
Requires-Dist: isort>=5.0.0; extra == "dev"
|
|
33
|
+
Requires-Dist: mypy>=1.0.0; extra == "dev"
|
|
34
|
+
Dynamic: license-file
|
|
35
|
+
|
|
36
|
+
# Agent Passport Python SDK
|
|
37
|
+
|
|
38
|
+
A production-grade thin Python SDK for The Passport for AI Agents, providing easy integration with agent authentication and policy verification via API calls. All policy logic, counters, and enforcement happen on the server side.
|
|
39
|
+
|
|
40
|
+
## Features
|
|
41
|
+
|
|
42
|
+
- ✅ **Thin Client Architecture** - No policy logic, no Cloudflare imports, no counters
|
|
43
|
+
- ✅ **Production Ready** - Timeouts, retries, proper error handling, Server-Timing support
|
|
44
|
+
- ✅ **Type Safe** - Full type hints with comprehensive type definitions
|
|
45
|
+
- ✅ **Idempotency Support** - Both header and body idempotency key support
|
|
46
|
+
- ✅ **Local Token Validation** - JWKS support for local decision token validation
|
|
47
|
+
- ✅ **Multiple Environments** - Production, sandbox, and self-hosted enterprise support
|
|
48
|
+
- ✅ **Async/Await** - Modern async Python with aiohttp
|
|
49
|
+
- ✅ **Context Manager** - Proper resource management with async context managers
|
|
50
|
+
|
|
51
|
+
## Installation
|
|
52
|
+
|
|
53
|
+
```bash
|
|
54
|
+
pip install aporthq-sdk-python
|
|
55
|
+
```
|
|
56
|
+
|
|
57
|
+
**Requirements:** Python 3.8 or higher
|
|
58
|
+
|
|
59
|
+
## Quick Start
|
|
60
|
+
|
|
61
|
+
```python
|
|
62
|
+
import asyncio
|
|
63
|
+
from aporthq_sdk_python import APortClient, APortClientOptions, PolicyVerifier, AportError
|
|
64
|
+
|
|
65
|
+
async def main():
|
|
66
|
+
# Initialize client for production
|
|
67
|
+
client = APortClient(APortClientOptions(
|
|
68
|
+
base_url="https://api.aport.io", # Production API
|
|
69
|
+
api_key="your-api-key", # Optional
|
|
70
|
+
timeout_ms=800 # Optional: Request timeout (default: 800ms)
|
|
71
|
+
))
|
|
72
|
+
|
|
73
|
+
# Or for sandbox/testing
|
|
74
|
+
sandbox_client = APortClient(APortClientOptions(
|
|
75
|
+
base_url="https://sandbox-api.aport.io", # Sandbox API
|
|
76
|
+
api_key="your-sandbox-key"
|
|
77
|
+
))
|
|
78
|
+
|
|
79
|
+
# Or for self-hosted enterprise
|
|
80
|
+
enterprise_client = APortClient(APortClientOptions(
|
|
81
|
+
base_url="https://your-company.aport.io", # Your self-hosted instance
|
|
82
|
+
api_key="your-enterprise-key"
|
|
83
|
+
))
|
|
84
|
+
|
|
85
|
+
# Create a policy verifier for convenience
|
|
86
|
+
verifier = PolicyVerifier(client)
|
|
87
|
+
|
|
88
|
+
# Verify a refund policy with proper error handling
|
|
89
|
+
try:
|
|
90
|
+
decision = await verifier.verify_refund(
|
|
91
|
+
"your-agent-id",
|
|
92
|
+
{
|
|
93
|
+
"amount": 1000,
|
|
94
|
+
"currency": "USD",
|
|
95
|
+
"order_id": "order_123",
|
|
96
|
+
"reason": "defective"
|
|
97
|
+
},
|
|
98
|
+
"unique-key-123" # idempotency key
|
|
99
|
+
)
|
|
100
|
+
|
|
101
|
+
if decision.allow:
|
|
102
|
+
print("✅ Refund approved!")
|
|
103
|
+
print(f"Decision ID: {decision.decision_id}")
|
|
104
|
+
print(f"Assurance Level: {decision.assurance_level}")
|
|
105
|
+
else:
|
|
106
|
+
print("❌ Refund denied!")
|
|
107
|
+
for reason in decision.reasons or []:
|
|
108
|
+
print(f" - [{reason.get('severity', 'info')}] {reason['code']}: {reason['message']}")
|
|
109
|
+
except AportError as error:
|
|
110
|
+
print(f"API Error {error.status}: {error}")
|
|
111
|
+
print(f"Reasons: {error.reasons}")
|
|
112
|
+
print(f"Decision ID: {error.decision_id}")
|
|
113
|
+
except Exception as error:
|
|
114
|
+
print(f"Policy verification failed: {error}")
|
|
115
|
+
|
|
116
|
+
if __name__ == "__main__":
|
|
117
|
+
asyncio.run(main())
|
|
118
|
+
```
|
|
119
|
+
|
|
120
|
+
## Environments
|
|
121
|
+
|
|
122
|
+
The SDK supports different environments through the `base_url` parameter:
|
|
123
|
+
|
|
124
|
+
- **Production**: `https://api.aport.io` - The main APort API
|
|
125
|
+
- **Sandbox**: `https://sandbox-api.aport.io` - Testing environment with mock data
|
|
126
|
+
- **Self-hosted**: `https://your-domain.com` - Your own APort instance
|
|
127
|
+
|
|
128
|
+
You can also host your own APort service for complete control over policy verification and data privacy.
|
|
129
|
+
|
|
130
|
+
## API Reference
|
|
131
|
+
|
|
132
|
+
### `APortClient`
|
|
133
|
+
|
|
134
|
+
The core client for interacting with the APort API endpoints.
|
|
135
|
+
|
|
136
|
+
#### `__init__(options: APortClientOptions)`
|
|
137
|
+
Initializes the APort client.
|
|
138
|
+
- `options.base_url` (str): The base URL of your APort API (e.g., `https://api.aport.io`).
|
|
139
|
+
- `options.api_key` (str, optional): Your API Key for authenticated requests.
|
|
140
|
+
- `options.timeout_ms` (int, optional): Request timeout in milliseconds (default: 800ms).
|
|
141
|
+
|
|
142
|
+
#### `async verify_policy(agent_id: str, policy_id: str, context: Dict[str, Any] = None, idempotency_key: str = None) -> PolicyVerificationResponse`
|
|
143
|
+
Verifies a policy against an agent by calling the `/api/verify/policy/:pack_id` endpoint.
|
|
144
|
+
- `agent_id` (str): The ID of the agent.
|
|
145
|
+
- `policy_id` (str): The ID of the policy pack (e.g., `finance.payment.refund.v1`, `code.release.publish.v1`).
|
|
146
|
+
- `context` (Dict[str, Any], optional): The policy-specific context data.
|
|
147
|
+
- `idempotency_key` (str, optional): An optional idempotency key for the request.
|
|
148
|
+
|
|
149
|
+
#### `async get_decision_token(agent_id: str, policy_id: str, context: Dict[str, Any] = None) -> str`
|
|
150
|
+
Retrieves a short-lived decision token for near-zero latency local validation. Calls `/api/verify/token/:pack_id`.
|
|
151
|
+
|
|
152
|
+
#### `async validate_decision_token(token: str) -> PolicyVerificationResponse`
|
|
153
|
+
Validates a decision token via server (for debugging). Calls `/api/verify/token/validate`.
|
|
154
|
+
|
|
155
|
+
#### `async validate_decision_token_local(token: str) -> PolicyVerificationResponse`
|
|
156
|
+
Validates a decision token locally using JWKS (recommended for production). Falls back to server validation if JWKS unavailable.
|
|
157
|
+
|
|
158
|
+
#### `async get_passport_view(agent_id: str) -> Dict[str, Any]`
|
|
159
|
+
Retrieves a small, cacheable view of an agent's passport (limits, assurance, status) for display purposes (e.g., about pages, debugging). Calls `/api/passports/:id/verify_view`.
|
|
160
|
+
|
|
161
|
+
#### `async get_jwks() -> Jwks`
|
|
162
|
+
Retrieves the JSON Web Key Set for local token validation. Cached for 5 minutes.
|
|
163
|
+
|
|
164
|
+
### `PolicyVerifier`
|
|
165
|
+
|
|
166
|
+
A convenience class that wraps `APortClient` to provide policy-specific verification methods.
|
|
167
|
+
|
|
168
|
+
#### `__init__(client: APortClient)`
|
|
169
|
+
Initializes the PolicyVerifier with an `APortClient` instance.
|
|
170
|
+
|
|
171
|
+
#### `async verify_refund(agent_id: str, context: Dict[str, Any], idempotency_key: str = None) -> PolicyVerificationResponse`
|
|
172
|
+
Verifies the `finance.payment.refund.v1` policy.
|
|
173
|
+
|
|
174
|
+
#### `async verify_repository(agent_id: str, context: Dict[str, Any], idempotency_key: str = None) -> PolicyVerificationResponse`
|
|
175
|
+
Verifies the `code.repository.merge.v1` policy.
|
|
176
|
+
|
|
177
|
+
#### Additional Policy Methods
|
|
178
|
+
The `PolicyVerifier` also includes convenience methods for other policies:
|
|
179
|
+
- `verify_release()` - Verifies the `code.release.publish.v1` policy
|
|
180
|
+
- `verify_data_export()` - Verifies the `data.export.create.v1` policy
|
|
181
|
+
- `verify_messaging()` - Verifies the `messaging.message.send.v1` policy
|
|
182
|
+
|
|
183
|
+
These methods follow the same pattern as `verify_refund()` and `verify_repository()`.
|
|
184
|
+
|
|
185
|
+
## Error Handling
|
|
186
|
+
|
|
187
|
+
The SDK raises `AportError` for API request failures with detailed error information.
|
|
188
|
+
|
|
189
|
+
```python
|
|
190
|
+
from aporthq_sdk_python import AportError
|
|
191
|
+
|
|
192
|
+
try:
|
|
193
|
+
await client.verify_policy("invalid-agent", "finance.payment.refund.v1", {})
|
|
194
|
+
except AportError as error:
|
|
195
|
+
print(f"Status: {error.status}")
|
|
196
|
+
print(f"Message: {error}")
|
|
197
|
+
print(f"Reasons: {error.reasons}")
|
|
198
|
+
print(f"Decision ID: {error.decision_id}")
|
|
199
|
+
print(f"Server Timing: {error.server_timing}")
|
|
200
|
+
except Exception as error:
|
|
201
|
+
print(f"Unexpected error: {error}")
|
|
202
|
+
```
|
|
203
|
+
|
|
204
|
+
### Error Types
|
|
205
|
+
|
|
206
|
+
- **`AportError`**: API request failures with status codes, reasons, and decision IDs
|
|
207
|
+
- **Timeout Errors**: 408 status with `TIMEOUT` reason code
|
|
208
|
+
- **Network Errors**: 0 status with `NETWORK_ERROR` reason code
|
|
209
|
+
|
|
210
|
+
## Production Features
|
|
211
|
+
|
|
212
|
+
### Idempotency Support
|
|
213
|
+
The SDK supports idempotency keys in both the request body and the `Idempotency-Key` header (header takes precedence).
|
|
214
|
+
|
|
215
|
+
```python
|
|
216
|
+
decision = await client.verify_policy(
|
|
217
|
+
"agent-123",
|
|
218
|
+
"finance.payment.refund.v1",
|
|
219
|
+
{"amount": 100, "currency": "USD"},
|
|
220
|
+
"unique-idempotency-key" # Sent in both header and body
|
|
221
|
+
)
|
|
222
|
+
```
|
|
223
|
+
|
|
224
|
+
### Server-Timing Support
|
|
225
|
+
The SDK automatically captures and exposes Server-Timing headers for performance monitoring.
|
|
226
|
+
|
|
227
|
+
```python
|
|
228
|
+
decision = await client.verify_policy("agent-123", "finance.payment.refund.v1", {})
|
|
229
|
+
print("Server timing:", decision._meta.get("serverTiming"))
|
|
230
|
+
# Example: "cache;dur=5,db;dur=12"
|
|
231
|
+
```
|
|
232
|
+
|
|
233
|
+
### Local Token Validation
|
|
234
|
+
For high-performance scenarios, use local token validation with JWKS:
|
|
235
|
+
|
|
236
|
+
```python
|
|
237
|
+
# Get JWKS (cached for 5 minutes)
|
|
238
|
+
jwks = await client.get_jwks()
|
|
239
|
+
|
|
240
|
+
# Validate token locally (no server round-trip)
|
|
241
|
+
decision = await client.validate_decision_token_local(token)
|
|
242
|
+
```
|
|
243
|
+
|
|
244
|
+
### Async Context Manager
|
|
245
|
+
Use the client as an async context manager for proper resource management:
|
|
246
|
+
|
|
247
|
+
```python
|
|
248
|
+
async with APortClient(options) as client:
|
|
249
|
+
decision = await client.verify_policy("agent-123", "finance.payment.refund.v1", {})
|
|
250
|
+
# Session is automatically closed
|
|
251
|
+
```
|
|
252
|
+
|
|
253
|
+
### Timeout and Retry Configuration
|
|
254
|
+
Configure timeouts and retry behavior:
|
|
255
|
+
|
|
256
|
+
```python
|
|
257
|
+
client = APortClient(APortClientOptions(
|
|
258
|
+
base_url="https://api.aport.io",
|
|
259
|
+
api_key="your-key",
|
|
260
|
+
timeout_ms=500 # 500ms timeout
|
|
261
|
+
))
|
|
262
|
+
```
|
|
263
|
+
|
|
264
|
+
## Type Hints
|
|
265
|
+
|
|
266
|
+
The SDK includes full type hints for all classes, methods, and types.
|
|
267
|
+
|
|
268
|
+
```python
|
|
269
|
+
from aporthq_sdk_python import APortClient, APortClientOptions, PolicyVerificationResponse
|
|
270
|
+
|
|
271
|
+
options: APortClientOptions = APortClientOptions(
|
|
272
|
+
base_url='https://api.aport.io',
|
|
273
|
+
api_key='my-secret-key',
|
|
274
|
+
timeout_ms=800
|
|
275
|
+
)
|
|
276
|
+
|
|
277
|
+
client: APortClient = APortClient(options)
|
|
278
|
+
|
|
279
|
+
decision: PolicyVerificationResponse = await client.verify_policy(
|
|
280
|
+
"agent_123",
|
|
281
|
+
"finance.payment.refund.v1",
|
|
282
|
+
{"amount": 500, "currency": "EUR"}
|
|
283
|
+
)
|
|
284
|
+
```
|
|
285
|
+
|
|
286
|
+
## License
|
|
287
|
+
|
|
288
|
+
MIT
|
|
@@ -0,0 +1,253 @@
|
|
|
1
|
+
# Agent Passport Python SDK
|
|
2
|
+
|
|
3
|
+
A production-grade thin Python SDK for The Passport for AI Agents, providing easy integration with agent authentication and policy verification via API calls. All policy logic, counters, and enforcement happen on the server side.
|
|
4
|
+
|
|
5
|
+
## Features
|
|
6
|
+
|
|
7
|
+
- ✅ **Thin Client Architecture** - No policy logic, no Cloudflare imports, no counters
|
|
8
|
+
- ✅ **Production Ready** - Timeouts, retries, proper error handling, Server-Timing support
|
|
9
|
+
- ✅ **Type Safe** - Full type hints with comprehensive type definitions
|
|
10
|
+
- ✅ **Idempotency Support** - Both header and body idempotency key support
|
|
11
|
+
- ✅ **Local Token Validation** - JWKS support for local decision token validation
|
|
12
|
+
- ✅ **Multiple Environments** - Production, sandbox, and self-hosted enterprise support
|
|
13
|
+
- ✅ **Async/Await** - Modern async Python with aiohttp
|
|
14
|
+
- ✅ **Context Manager** - Proper resource management with async context managers
|
|
15
|
+
|
|
16
|
+
## Installation
|
|
17
|
+
|
|
18
|
+
```bash
|
|
19
|
+
pip install aporthq-sdk-python
|
|
20
|
+
```
|
|
21
|
+
|
|
22
|
+
**Requirements:** Python 3.8 or higher
|
|
23
|
+
|
|
24
|
+
## Quick Start
|
|
25
|
+
|
|
26
|
+
```python
|
|
27
|
+
import asyncio
|
|
28
|
+
from aporthq_sdk_python import APortClient, APortClientOptions, PolicyVerifier, AportError
|
|
29
|
+
|
|
30
|
+
async def main():
|
|
31
|
+
# Initialize client for production
|
|
32
|
+
client = APortClient(APortClientOptions(
|
|
33
|
+
base_url="https://api.aport.io", # Production API
|
|
34
|
+
api_key="your-api-key", # Optional
|
|
35
|
+
timeout_ms=800 # Optional: Request timeout (default: 800ms)
|
|
36
|
+
))
|
|
37
|
+
|
|
38
|
+
# Or for sandbox/testing
|
|
39
|
+
sandbox_client = APortClient(APortClientOptions(
|
|
40
|
+
base_url="https://sandbox-api.aport.io", # Sandbox API
|
|
41
|
+
api_key="your-sandbox-key"
|
|
42
|
+
))
|
|
43
|
+
|
|
44
|
+
# Or for self-hosted enterprise
|
|
45
|
+
enterprise_client = APortClient(APortClientOptions(
|
|
46
|
+
base_url="https://your-company.aport.io", # Your self-hosted instance
|
|
47
|
+
api_key="your-enterprise-key"
|
|
48
|
+
))
|
|
49
|
+
|
|
50
|
+
# Create a policy verifier for convenience
|
|
51
|
+
verifier = PolicyVerifier(client)
|
|
52
|
+
|
|
53
|
+
# Verify a refund policy with proper error handling
|
|
54
|
+
try:
|
|
55
|
+
decision = await verifier.verify_refund(
|
|
56
|
+
"your-agent-id",
|
|
57
|
+
{
|
|
58
|
+
"amount": 1000,
|
|
59
|
+
"currency": "USD",
|
|
60
|
+
"order_id": "order_123",
|
|
61
|
+
"reason": "defective"
|
|
62
|
+
},
|
|
63
|
+
"unique-key-123" # idempotency key
|
|
64
|
+
)
|
|
65
|
+
|
|
66
|
+
if decision.allow:
|
|
67
|
+
print("✅ Refund approved!")
|
|
68
|
+
print(f"Decision ID: {decision.decision_id}")
|
|
69
|
+
print(f"Assurance Level: {decision.assurance_level}")
|
|
70
|
+
else:
|
|
71
|
+
print("❌ Refund denied!")
|
|
72
|
+
for reason in decision.reasons or []:
|
|
73
|
+
print(f" - [{reason.get('severity', 'info')}] {reason['code']}: {reason['message']}")
|
|
74
|
+
except AportError as error:
|
|
75
|
+
print(f"API Error {error.status}: {error}")
|
|
76
|
+
print(f"Reasons: {error.reasons}")
|
|
77
|
+
print(f"Decision ID: {error.decision_id}")
|
|
78
|
+
except Exception as error:
|
|
79
|
+
print(f"Policy verification failed: {error}")
|
|
80
|
+
|
|
81
|
+
if __name__ == "__main__":
|
|
82
|
+
asyncio.run(main())
|
|
83
|
+
```
|
|
84
|
+
|
|
85
|
+
## Environments
|
|
86
|
+
|
|
87
|
+
The SDK supports different environments through the `base_url` parameter:
|
|
88
|
+
|
|
89
|
+
- **Production**: `https://api.aport.io` - The main APort API
|
|
90
|
+
- **Sandbox**: `https://sandbox-api.aport.io` - Testing environment with mock data
|
|
91
|
+
- **Self-hosted**: `https://your-domain.com` - Your own APort instance
|
|
92
|
+
|
|
93
|
+
You can also host your own APort service for complete control over policy verification and data privacy.
|
|
94
|
+
|
|
95
|
+
## API Reference
|
|
96
|
+
|
|
97
|
+
### `APortClient`
|
|
98
|
+
|
|
99
|
+
The core client for interacting with the APort API endpoints.
|
|
100
|
+
|
|
101
|
+
#### `__init__(options: APortClientOptions)`
|
|
102
|
+
Initializes the APort client.
|
|
103
|
+
- `options.base_url` (str): The base URL of your APort API (e.g., `https://api.aport.io`).
|
|
104
|
+
- `options.api_key` (str, optional): Your API Key for authenticated requests.
|
|
105
|
+
- `options.timeout_ms` (int, optional): Request timeout in milliseconds (default: 800ms).
|
|
106
|
+
|
|
107
|
+
#### `async verify_policy(agent_id: str, policy_id: str, context: Dict[str, Any] = None, idempotency_key: str = None) -> PolicyVerificationResponse`
|
|
108
|
+
Verifies a policy against an agent by calling the `/api/verify/policy/:pack_id` endpoint.
|
|
109
|
+
- `agent_id` (str): The ID of the agent.
|
|
110
|
+
- `policy_id` (str): The ID of the policy pack (e.g., `finance.payment.refund.v1`, `code.release.publish.v1`).
|
|
111
|
+
- `context` (Dict[str, Any], optional): The policy-specific context data.
|
|
112
|
+
- `idempotency_key` (str, optional): An optional idempotency key for the request.
|
|
113
|
+
|
|
114
|
+
#### `async get_decision_token(agent_id: str, policy_id: str, context: Dict[str, Any] = None) -> str`
|
|
115
|
+
Retrieves a short-lived decision token for near-zero latency local validation. Calls `/api/verify/token/:pack_id`.
|
|
116
|
+
|
|
117
|
+
#### `async validate_decision_token(token: str) -> PolicyVerificationResponse`
|
|
118
|
+
Validates a decision token via server (for debugging). Calls `/api/verify/token/validate`.
|
|
119
|
+
|
|
120
|
+
#### `async validate_decision_token_local(token: str) -> PolicyVerificationResponse`
|
|
121
|
+
Validates a decision token locally using JWKS (recommended for production). Falls back to server validation if JWKS unavailable.
|
|
122
|
+
|
|
123
|
+
#### `async get_passport_view(agent_id: str) -> Dict[str, Any]`
|
|
124
|
+
Retrieves a small, cacheable view of an agent's passport (limits, assurance, status) for display purposes (e.g., about pages, debugging). Calls `/api/passports/:id/verify_view`.
|
|
125
|
+
|
|
126
|
+
#### `async get_jwks() -> Jwks`
|
|
127
|
+
Retrieves the JSON Web Key Set for local token validation. Cached for 5 minutes.
|
|
128
|
+
|
|
129
|
+
### `PolicyVerifier`
|
|
130
|
+
|
|
131
|
+
A convenience class that wraps `APortClient` to provide policy-specific verification methods.
|
|
132
|
+
|
|
133
|
+
#### `__init__(client: APortClient)`
|
|
134
|
+
Initializes the PolicyVerifier with an `APortClient` instance.
|
|
135
|
+
|
|
136
|
+
#### `async verify_refund(agent_id: str, context: Dict[str, Any], idempotency_key: str = None) -> PolicyVerificationResponse`
|
|
137
|
+
Verifies the `finance.payment.refund.v1` policy.
|
|
138
|
+
|
|
139
|
+
#### `async verify_repository(agent_id: str, context: Dict[str, Any], idempotency_key: str = None) -> PolicyVerificationResponse`
|
|
140
|
+
Verifies the `code.repository.merge.v1` policy.
|
|
141
|
+
|
|
142
|
+
#### Additional Policy Methods
|
|
143
|
+
The `PolicyVerifier` also includes convenience methods for other policies:
|
|
144
|
+
- `verify_release()` - Verifies the `code.release.publish.v1` policy
|
|
145
|
+
- `verify_data_export()` - Verifies the `data.export.create.v1` policy
|
|
146
|
+
- `verify_messaging()` - Verifies the `messaging.message.send.v1` policy
|
|
147
|
+
|
|
148
|
+
These methods follow the same pattern as `verify_refund()` and `verify_repository()`.
|
|
149
|
+
|
|
150
|
+
## Error Handling
|
|
151
|
+
|
|
152
|
+
The SDK raises `AportError` for API request failures with detailed error information.
|
|
153
|
+
|
|
154
|
+
```python
|
|
155
|
+
from aporthq_sdk_python import AportError
|
|
156
|
+
|
|
157
|
+
try:
|
|
158
|
+
await client.verify_policy("invalid-agent", "finance.payment.refund.v1", {})
|
|
159
|
+
except AportError as error:
|
|
160
|
+
print(f"Status: {error.status}")
|
|
161
|
+
print(f"Message: {error}")
|
|
162
|
+
print(f"Reasons: {error.reasons}")
|
|
163
|
+
print(f"Decision ID: {error.decision_id}")
|
|
164
|
+
print(f"Server Timing: {error.server_timing}")
|
|
165
|
+
except Exception as error:
|
|
166
|
+
print(f"Unexpected error: {error}")
|
|
167
|
+
```
|
|
168
|
+
|
|
169
|
+
### Error Types
|
|
170
|
+
|
|
171
|
+
- **`AportError`**: API request failures with status codes, reasons, and decision IDs
|
|
172
|
+
- **Timeout Errors**: 408 status with `TIMEOUT` reason code
|
|
173
|
+
- **Network Errors**: 0 status with `NETWORK_ERROR` reason code
|
|
174
|
+
|
|
175
|
+
## Production Features
|
|
176
|
+
|
|
177
|
+
### Idempotency Support
|
|
178
|
+
The SDK supports idempotency keys in both the request body and the `Idempotency-Key` header (header takes precedence).
|
|
179
|
+
|
|
180
|
+
```python
|
|
181
|
+
decision = await client.verify_policy(
|
|
182
|
+
"agent-123",
|
|
183
|
+
"finance.payment.refund.v1",
|
|
184
|
+
{"amount": 100, "currency": "USD"},
|
|
185
|
+
"unique-idempotency-key" # Sent in both header and body
|
|
186
|
+
)
|
|
187
|
+
```
|
|
188
|
+
|
|
189
|
+
### Server-Timing Support
|
|
190
|
+
The SDK automatically captures and exposes Server-Timing headers for performance monitoring.
|
|
191
|
+
|
|
192
|
+
```python
|
|
193
|
+
decision = await client.verify_policy("agent-123", "finance.payment.refund.v1", {})
|
|
194
|
+
print("Server timing:", decision._meta.get("serverTiming"))
|
|
195
|
+
# Example: "cache;dur=5,db;dur=12"
|
|
196
|
+
```
|
|
197
|
+
|
|
198
|
+
### Local Token Validation
|
|
199
|
+
For high-performance scenarios, use local token validation with JWKS:
|
|
200
|
+
|
|
201
|
+
```python
|
|
202
|
+
# Get JWKS (cached for 5 minutes)
|
|
203
|
+
jwks = await client.get_jwks()
|
|
204
|
+
|
|
205
|
+
# Validate token locally (no server round-trip)
|
|
206
|
+
decision = await client.validate_decision_token_local(token)
|
|
207
|
+
```
|
|
208
|
+
|
|
209
|
+
### Async Context Manager
|
|
210
|
+
Use the client as an async context manager for proper resource management:
|
|
211
|
+
|
|
212
|
+
```python
|
|
213
|
+
async with APortClient(options) as client:
|
|
214
|
+
decision = await client.verify_policy("agent-123", "finance.payment.refund.v1", {})
|
|
215
|
+
# Session is automatically closed
|
|
216
|
+
```
|
|
217
|
+
|
|
218
|
+
### Timeout and Retry Configuration
|
|
219
|
+
Configure timeouts and retry behavior:
|
|
220
|
+
|
|
221
|
+
```python
|
|
222
|
+
client = APortClient(APortClientOptions(
|
|
223
|
+
base_url="https://api.aport.io",
|
|
224
|
+
api_key="your-key",
|
|
225
|
+
timeout_ms=500 # 500ms timeout
|
|
226
|
+
))
|
|
227
|
+
```
|
|
228
|
+
|
|
229
|
+
## Type Hints
|
|
230
|
+
|
|
231
|
+
The SDK includes full type hints for all classes, methods, and types.
|
|
232
|
+
|
|
233
|
+
```python
|
|
234
|
+
from aporthq_sdk_python import APortClient, APortClientOptions, PolicyVerificationResponse
|
|
235
|
+
|
|
236
|
+
options: APortClientOptions = APortClientOptions(
|
|
237
|
+
base_url='https://api.aport.io',
|
|
238
|
+
api_key='my-secret-key',
|
|
239
|
+
timeout_ms=800
|
|
240
|
+
)
|
|
241
|
+
|
|
242
|
+
client: APortClient = APortClient(options)
|
|
243
|
+
|
|
244
|
+
decision: PolicyVerificationResponse = await client.verify_policy(
|
|
245
|
+
"agent_123",
|
|
246
|
+
"finance.payment.refund.v1",
|
|
247
|
+
{"amount": 500, "currency": "EUR"}
|
|
248
|
+
)
|
|
249
|
+
```
|
|
250
|
+
|
|
251
|
+
## License
|
|
252
|
+
|
|
253
|
+
MIT
|
|
@@ -0,0 +1,65 @@
|
|
|
1
|
+
[build-system]
|
|
2
|
+
requires = ["setuptools>=61.0", "wheel"]
|
|
3
|
+
build-backend = "setuptools.build_meta"
|
|
4
|
+
|
|
5
|
+
[project]
|
|
6
|
+
name = "aporthq-sdk-python"
|
|
7
|
+
version = "0.1.0"
|
|
8
|
+
description = "Python SDK for The Passport for AI Agents"
|
|
9
|
+
authors = [
|
|
10
|
+
{name = "APort Team", email = "team@aport.io"}
|
|
11
|
+
]
|
|
12
|
+
license = {text = "MIT"}
|
|
13
|
+
readme = "README.md"
|
|
14
|
+
requires-python = ">=3.8"
|
|
15
|
+
classifiers = [
|
|
16
|
+
"Development Status :: 4 - Beta",
|
|
17
|
+
"Intended Audience :: Developers",
|
|
18
|
+
"Programming Language :: Python :: 3",
|
|
19
|
+
"Programming Language :: Python :: 3.8",
|
|
20
|
+
"Programming Language :: Python :: 3.9",
|
|
21
|
+
"Programming Language :: Python :: 3.10",
|
|
22
|
+
"Programming Language :: Python :: 3.11",
|
|
23
|
+
"Programming Language :: Python :: 3.12",
|
|
24
|
+
"Topic :: Software Development :: Libraries :: Python Modules",
|
|
25
|
+
"Topic :: Security",
|
|
26
|
+
"Topic :: Internet :: WWW/HTTP :: Dynamic Content",
|
|
27
|
+
]
|
|
28
|
+
dependencies = [
|
|
29
|
+
"aiohttp>=3.8.0",
|
|
30
|
+
"typing-extensions>=4.0.0",
|
|
31
|
+
]
|
|
32
|
+
keywords = ["agent-passport", "ai", "authentication", "verification", "aport", "mcp", "middleware"]
|
|
33
|
+
|
|
34
|
+
[project.urls]
|
|
35
|
+
Homepage = "https://aport.io"
|
|
36
|
+
Documentation = "https://aport.io/docs"
|
|
37
|
+
Repository = "https://github.com/aporthq/agent-passport"
|
|
38
|
+
Issues = "https://github.com/aporthq/agent-passport/issues"
|
|
39
|
+
|
|
40
|
+
[project.optional-dependencies]
|
|
41
|
+
dev = [
|
|
42
|
+
"pytest>=7.0.0",
|
|
43
|
+
"pytest-cov>=4.0.0",
|
|
44
|
+
"black>=22.0.0",
|
|
45
|
+
"isort>=5.0.0",
|
|
46
|
+
"mypy>=1.0.0",
|
|
47
|
+
]
|
|
48
|
+
|
|
49
|
+
[tool.setuptools.packages.find]
|
|
50
|
+
where = ["src"]
|
|
51
|
+
include = ["aporthq_sdk_python*"]
|
|
52
|
+
|
|
53
|
+
[tool.black]
|
|
54
|
+
line-length = 88
|
|
55
|
+
target-version = ['py38']
|
|
56
|
+
|
|
57
|
+
[tool.isort]
|
|
58
|
+
profile = "black"
|
|
59
|
+
line_length = 88
|
|
60
|
+
|
|
61
|
+
[tool.mypy]
|
|
62
|
+
python_version = "3.8"
|
|
63
|
+
warn_return_any = true
|
|
64
|
+
warn_unused_configs = true
|
|
65
|
+
disallow_untyped_defs = true
|
|
@@ -0,0 +1,42 @@
|
|
|
1
|
+
"""
|
|
2
|
+
Agent Passport SDK for Python
|
|
3
|
+
|
|
4
|
+
A production-grade thin Python SDK for The Passport for AI Agents, providing
|
|
5
|
+
easy integration with agent authentication and policy verification via API calls.
|
|
6
|
+
All policy logic, counters, and enforcement happen on the server side.
|
|
7
|
+
"""
|
|
8
|
+
|
|
9
|
+
from .thin_client import APortClient, APortClientOptions, PolicyVerifier
|
|
10
|
+
from .decision_types import (
|
|
11
|
+
Decision,
|
|
12
|
+
DecisionReason,
|
|
13
|
+
VerificationContext,
|
|
14
|
+
PolicyVerificationRequest,
|
|
15
|
+
PolicyVerificationResponse,
|
|
16
|
+
Jwks,
|
|
17
|
+
)
|
|
18
|
+
from .errors import AportError
|
|
19
|
+
|
|
20
|
+
# Backward compatibility - re-export from shared_types
|
|
21
|
+
from .shared_types import PassportData, AgentPassport
|
|
22
|
+
|
|
23
|
+
__version__ = "0.1.0"
|
|
24
|
+
__all__ = [
|
|
25
|
+
# Core SDK
|
|
26
|
+
"APortClient",
|
|
27
|
+
"APortClientOptions",
|
|
28
|
+
"PolicyVerifier",
|
|
29
|
+
"AportError",
|
|
30
|
+
|
|
31
|
+
# Decision types
|
|
32
|
+
"Decision",
|
|
33
|
+
"DecisionReason",
|
|
34
|
+
"VerificationContext",
|
|
35
|
+
"PolicyVerificationRequest",
|
|
36
|
+
"PolicyVerificationResponse",
|
|
37
|
+
"Jwks",
|
|
38
|
+
|
|
39
|
+
# Backward compatibility
|
|
40
|
+
"PassportData",
|
|
41
|
+
"AgentPassport",
|
|
42
|
+
]
|